I don’t know whether this post will get any readers. I hope so, because I’m hoping someone will have some ideas for me (sympathy works, too). I’m semi-retired after a career mostly in IT services. I manage a small size network (40+ hosts) for a 24/7/365 business run by a cousin.
We support operating systems ranging from Windows 98 2nd Edition to Windows 10 on desktops and Windows 2012R2 (soon to be Windows 2016) on servers. The older machines support specific hardware. We could replace the in-house hardware but new equipment would not be an exact match for the old. We aren’t big enough to demand that our customers replace good working equipment with new equipment. I’m reminded of the article by Will Fastie on the Dymo Label printer.
I spend a fair amount of time working on hardening our electronic security posture. Unfortunately, because of old hardware, there is no way I can remove the Windows XP clients. Business management is done using Windows 10 clients, but those clients need to access files generated on Windows XP clients. SMBv1 still lives on a third of the clients. Some of the older systems can be segmented away, but don’t think that will cover all of the cases. Most of the employees are not technically sophisticated, so transparent solutions are necessary.
This issue surfaced again due to the Windows Updates in December. KB5021294 (December Security Monthly Rollup) blocked SMBv1 on our network. Uninstalling the update from both domain controllers was sufficient to restore SMBv1 functionality. I’m pretty sure this was an unintended consequence, as nothing that I read from Microsoft called out this behavior. A quick online search did not show that this was a problem for anyone else; admittedly I have a corner case. It’s not reasonable to expect Microsoft to do regression testing back any further than their currently supported systems (or maybe a bit more – say back to Windows 7). Still, it took me some time to figure out what caused the problem and how to fix it, and I won’t get that time back.
The computer industry changes much faster than most other industries. If a computer is loosely integrated into a larger system, this isn’t much of a problem. For instance, moving from Windows 7 to Windows 10 and re-installing applications is usually straightforward. The worker affected by the change is expected to manage any required adaptation. If a computer is tightly integrated into a larger system, this can be a major problem. Larger systems have longer life cycles (sometimes much longer). I suspect that designers consider the computer to be a modular component that is easily replaced. That’s just not true after several years.
This is not intended to be a rant (although I admit feeling a bit grumpy). This isn’t an emergency cry for help. I keep busy learning how to harden networks. If anyone faces a similar situation and would like to share solution strategies or just some war stories, I’d be grateful to hear from you. Thanks.
